CVE-2021-47901

CVE-2021-47901 is a CSV injection vulnerability affecting Dirsearch version 0.4.1, a directory and file path brute-forcer tool. The flaw arises when the --csv-report flag is used to generate reports, enabling attackers to inject malicious formulas via redirected endpoints. Specifically, attackers can craft server redirects containing comma-separated paths embedded with Excel formulas, which manipulate the output CSV file. The vulnerability is rated at CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1236.

Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction, requiring only low attack complexity over the network. By controlling a server that Dirsearch queries during a scan, an attacker redirects requests to paths with injected formulas (e.g., =cmd|' /C calc'!A0), which are written unescaped into the CSV report. When a victim opens the report in spreadsheet software like Excel, the formulas execute, potentially leading to arbitrary code execution, data exfiltration, or other impacts aligned with the high confidentiality, integrity, and availability ratings.

Advisories and references provide additional details on exploitation and mitigation. The Vulncheck advisory at https://www.vulncheck.com/advisories/dirsearch-csv-injection outlines the issue, while an exploit proof-of-concept is available at https://www.exploit-db.com/exploits/49370. The Dirsearch GitHub repository at https://github.com/maurosoria/dirsearch serves as the primary source for checking updates or patches.